libexpat: libexpat: Arbitrary code execution due to integer overflow

An integer overflow exists in libexpat's doProlog function due to improper handling of entity value lengths. A local attacker could exploit this to execute arbitrary code or access sensitive system data...

PT-2026-51243

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.8.2 Description An integer overflow occurs in the doProlog function, specifically related to storeEntityValue and the entity textLen variable. An integer overflow is a condition where an arithmetic operation attemp...

CLSA-2026-1774433526 expat: Fix of CVE-2026-32776

CVE-2026-32776: fix NULL pointer dereference in storeEntityValue with empty external parameter entity content...

OSV-2026-190 Security exception in com.ctc.wstx.util.TextBuffer.buildResultArray

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=480987597 Crash type: Security exception Crash state: com.ctc.wstx.util.TextBuffer.buildResultArray com.ctc.wstx.util.TextBuffer.contentsAsArray com.ctc.wstx.dtd.FullDTDReader.parseEntityValue...

Use After Free

libqpdf.so is vulnerable to Use After Free. The vulnerability exists due to a lack of entity value validations in the libqpdf parameter of PlAESPDF.cc. An attacker could exploit arbitrary code into the system...

Use After Free

libgpac.so is vulnerable to Use-After-Free. The vulnerability exists due to a lack of entity value validations in the m2tsdmxdeclarepid parameter in dmxm2ts.c which leads to memory consumption resulting in an application crash...

Denial Of Service (DOS)

libgpac.so is vulnerable to Denial of Service. The vulnerability exists due to a lack of entity value validations in the descriptors.c which leads to use-after-free resulting in an application crash...

libxml2: integer overflows with XML_PARSE_HUGE

A flaw was found in libxml2. Parsing a XML document with the XMLPARSEHUGE option enabled can result in an integer overflow because safety checks were missing in some functions. Also, the xmlParseEntityValue function didn't have any length limitation...

libxml2: integer overflows with XML_PARSE_HUGE

A flaw was found in libxml2. Parsing a XML document with the XMLPARSEHUGE option enabled can result in an integer overflow because safety checks were missing in some functions. Also, the xmlParseEntityValue function didn't have any length limitation...

libxml2: integer overflows with XML_PARSE_HUGE

A flaw was found in libxml2. Parsing a XML document with the XMLPARSEHUGE option enabled can result in an integer overflow because safety checks were missing in some functions. Also, the xmlParseEntityValue function didn't have any length limitation...

OESA-2022-2081 libxml2 security update

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

Use After Free

libexpat.so is vulnerable to use-after-free. The vulnerability exists due to a lack of entity value validations in the XMLParserFree parameter of the parserCreate function in xmlparse.c. An attacker could exploit it to lead to memory consumption resulting in an application crash...

CVE-2020-6615

GNU LibreDWG 0.9.3.2564 has an invalid pointer dereference in dwgdynapientityvalue in dynapi.c dynapi.c is generated by gen-dynapi.pl...

Expat XML External Entity Denial of Service Vulnerability

Expat is a C language written in a stream-oriented XML parser library . Expat XML External Entity Denial of Service Vulnerability. The vulnerability stems from the presence of malformed XML in external entities in Expat's entityValueInitProcessor function, which can be exploited by an attacker to...